Forethought AI procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | medium | “We maintain primary data centers in the United States. Personal information may be stored and processed in your region or the United States. As we integrate our services, your data may be migrated from Forethought’s legacy infrastructure to the Zendesk AWS infrastructure and processed in any country where Zendesk or its service providers maintain facilities.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We take steps designed to ensure that the personal information we collect under this Policy is processed as described in this Policy and according to applicable law. We maintain primary data centers in the United States. Personal information may be stored and processed in your region or the United States. As we integrate our services, your data may be migrated from Forethought’s legacy infrastructure to the Zendesk AWS infrastructure and processed in any country where Zendesk or its service providers maintain facilities. In particular, we may transfer personal information from the European Economic Area (EEA), UK, and Switzerland (collectively (‘ Europe ’) to other countries that may not have the same level of data protection that applies in your jurisdiction. In these cases, we use a variety of legal mechanisms to ensure that the recipient of your personal information offers an adequate level of protection, including entering into the standard contractual clauses for the transfer of personal information approved by the European Commission, or where required, we will ask you for your prior consent. If you require further information about our international transfers of personal information, please contact us using the contact details in the “How to Contact Us” section further below.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Forethought will retain your personal information for as long as is necessary for the purposes it was collected, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly. We determine the appropriate retention period for personal information based on the amount, nature and sensitivity of your personal information processed, the potential risk of harm from unauthorized use or disclosure of your personal information and whether we can achieve the purposes of the processing through other means, as well as applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal information will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of that personal information. For further information on applicable data retention periods, please contact us (see “How to Contact Us” below).” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “Forethought will retain your personal information for as long as is necessary for the purposes it was collected, or for other essential purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types in the context of different services, actual retention periods can vary significantly. We determine the appropriate retention period for personal information based on the amount, nature and sensitivity of your personal information processed, the potential risk of harm from unauthorized use or disclosure of your personal information and whether we can achieve the purposes of the processing through other means, as well as applicable legal requirements (such as applicable statutes of limitation).” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “After expiry of the applicable retention periods, your personal information will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of that personal information.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “• Sponsors of events or promotions ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company. In accordance with applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In general, Forethought sells its product and services to business customers. As a result, for much of the personal information we process through our product and services, we act as the data processor or sub-processor when processing personal information. This means that it is our business customers that control what personal information we collect and how we use it. If you have privacy related questions or concerns about the privacy practices of or the choices the relevant business customer has made to share or collect your personal information with us, please contact the relevant business customer directly or review their privacy policies. Forethought Google Connector uses Google APIs according to the Google API Services User Data Policy . More information can be found here . We are not responsible for the privacy or data security practices of our business customers, which may differ from those set forth in this Policy. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for analytics, cloud storage and customer support ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ with your consent , for example, when you agree to our disclosure of your information with other third parties for their own marketing purposes, subject to their separate privacy policies. We may also share aggregated or deidentified usage data with third parties to help us perform analysis and make improvements. Additionally, we may share anonymous usage data on an aggregate basis in the normal course of operating our business; for example, we may share information publicly to show trends in the use of our products and services.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for cloud storage, background checks and other recruitment purposes and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We are not responsible for the privacy or data security practices of our business customers, which may differ from those set forth in this Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may disclose your personal information to third parties for legitimate purposes subject to this Policy, including as follows: with our affiliates within the Zendesk corporate group (including our parent company, Zendesk, Inc.) to the extent such disclosure of personal information is necessary for integrated customer support, marketing, technical operations, and group-wide account management purposes. with your affiliated customer responsible for your access to the Services if you use our services as an authorized user, to the extent this is necessary including for verifying accounts and activity, investigating suspicious activity, or enforcing our terms and policies. with our contracted vendors, consultants, and other third parties who provide services to us such as IT and system administration and hosting, research and analytics, marketing, customer support, and data enrichment for the purposes described above.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.” | Captured 2026-07-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “• Affiliated customers;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ • Service providers, including for cloud storage, customer support and payment processing and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “• Affiliates;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for cloud storage, customer support, marketing and payment processing;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ to (i) comply with laws or to respond to lawful requests and legal process, (ii) protect the rights and property of Forethought and our agents, customers, and others, including to enforce our agreements, policies, and terms of use, or (iii) in an emergency, to protect the personal safety of Forethought, its customers, or any person. in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets to another company. In accordance with applicable laws, we will use reasonable efforts to notify you of any transfer of personal information to an unaffiliated third party.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ • Affiliated customers; and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ • Service providers for cloud storage and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “• Affiliates; and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ • Service providers for cloud storage ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for cloud storage, customer support, payment processing and marketing;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose your personal information to third parties for legitimate purposes subject to this Policy, including as follows: with our affiliates within the Zendesk corporate group (including our parent company, Zendesk, Inc.) to the extent such disclosure of personal information is necessary for integrated customer support, marketing, technical operations, and group-wide account management purposes. with your affiliated customer responsible for your access to the Services if you use our services as an authorized user, to the extent this is necessary including for verifying accounts and activity, investigating suspicious activity, or enforcing our terms and policies. with our contracted vendors, consultants, and other third parties who provide services to us such as IT and system administration and hosting, research and analytics, marketing, customer support, and data enrichment for the purposes described above. with sponsors of events or promotions for which you register. For example, if you attend an event or webinar organized by us, or download or access materials on our website, we may disclose your data with sponsors of the event. If required by applicable law, you can consent to such disclosure via the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your information will be subject to the sponsors’ privacy statements. If you do not want your information disclosed, you can choose to not opt in upon registration or elect to not have your badge scanned, or you can opt out according to the “Your Privacy Rights” section below. ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ • Affiliates ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for cloud storage and security purposes;” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for analytics, cloud storage and customer support and” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “• Affiliated customers ” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ • Service providers, including for analytics and cloud storage ” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.